---
title: "Manage cloud platform network access"
sidebar_label: "Manage cloud platform network access"
sidebar_position: 2
description: "How cloud platform network access is governed by projects and a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage cloud platform network access

Cloud platform network access is governed by:

* [projects](/access-control/projects/about-projects.mdx) — define access within an isolated group of resources;
* [role model](#access-within-roles) — defines access for [different users](/access-control/user-types.mdx) within an account and [project](/access-control/projects/about-projects.mdx).

## Access within the role model \{#access-within-roles}

Read more about access within the role model in the instruction [Access management in Selectel products](/access-control/access-management/).

This instruction describes the roles for accessing network resources in the cloud platform: private networks, subnets and ports, public subnets and ports, direct public IP addresses, public floating IP addresses, and cloud routers. [Access to load balancers](/cloud-servers/load-balancers/manage-access.mdx), [access to cloud firewalls](/cloud-servers/firewalls/manage-access.mdx), and [access to security groups are regulated separately](/cloud-servers/security-groups/manage-access.mdx).

### member \{#member}

User with full access to all services. Access management is not available for [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of all cloud platform network resources and information about them in all projects;

          * managing private networks, subnets, and ports in all projects:
            * creating and deleting a network and subnet;
            * changing the name and tags of a network and subnet;
            * configuring network access in different projects;
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it;
            * connecting a network to a global router and disconnecting it;
            * creating a port in a network and deleting a port;
            * enabling and disabling a port in a network;
            * managing allowed addresses and security groups on a port in a network;

          * managing public subnets in all projects:
            * creating and deleting a subnet;
            * changing the name and tags of a subnet;
            * changing DNS servers;
            * configuring access to a subnet in different projects;
            * creating and deleting a port in a subnet;

          * managing direct public IP addresses in all projects:
            * creating an IP address with an associated port;
            * deleting an IP address with an associated port;
            * enabling and disabling a port with an IP address;

          * managing public floating IP addresses in all projects:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing cloud routers in all projects:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of all cloud platform network resources and information about them in your project;

          * managing private networks, subnets, and ports in your project:
            * creating and deleting a network and subnet;
            * changing network and subnet names and tags;
            * configuring network access in different projects (access to each project is required);
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it;
            * creating a port in a network and deleting a port;
            * enabling and disabling a port in a network;
            * managing allowed addresses and security groups on a port;

          * managing public subnets in your project:
            * creating and deleting a subnet;
            * changing subnet name and tags;
            * changing DNS servers;
            * configuring access to a subnet in different projects;
            * creating and deleting a port in a subnet;
            * enabling and disabling a port in a network;

          * managing direct public IP addresses in your project:
            * creating an IP address with an associated port;
            * deleting an IP address with an associated port;
            * changing a port with an IP address;
            * detaching a port;

          * managing public floating IP addresses in your project:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing cloud routers in your project:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.admin \{#iam-admin}

User with access to user management, but without access to services and billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available cloud platform network operations</th>

        <td>
          * Managing [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to cloud platform networks, as well as managing [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.viewer \{#iam-viewer}

User with access to view everything that [iam.admin](#iam-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available cloud platform network operations</th>

        <td>
          * Viewing [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/);
          * viewing user keys;
          * viewing [notifications](/account/notifications.mdx) of other users;
          * viewing [account access restrictions](/account/limit-access-to-account.mdx)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### reader \{#reader}

User with access to view everything that [`member`](#member) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of all cloud platform network resources and information about them in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of all cloud platform network resources and information about them in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.admin \{#vpc-admin}

User with access to managing cloud platform networks (private networks and subnets, public subnets and public floating IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the [`member`](/access-control/role-reference.mdx#member) role.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of all cloud platform network resources and information about them in all projects;

          * managing private networks, subnets, and ports in all projects:
            * creating and deleting a network and subnet;
            * changing network and subnet names and tags;
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it;
            * connecting a subnet to a global router and disconnecting it (also requires the [`global_router.admin`](/access-control/role-reference.mdx#global-router-admin) role);
            * creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server);
            * enabling and disabling a port in a network;

          * managing public subnets in all projects:
            * creating and deleting a subnet;
            * changing subnet name and tags;
            * changing DNS servers;
            * creating and deleting a port in a subnet;
            * enabling and disabling a port in a network;

          * managing direct public IP addresses in all projects:
            * creating an IP address with an associated port (without adding to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * enabling and disabling a port with an IP address;

          * managing public floating IP addresses in all projects:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing cloud routers in all projects:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of all cloud platform network resources and information about them in your project;

          * managing private networks, subnets, and ports in your project:
            * creating and deleting a network and subnet;
            * changing network and subnet names and tags;
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it;
            * connecting a subnet to a global router and disconnecting it (also requires the [`global_router.admin`](/access-control/role-reference.mdx#global-router-admin) role);
            * creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server);
            * enabling and disabling a port in a network;

          * managing public subnets in your project:
            * creating and deleting a subnet;
            * changing subnet name and tags;
            * changing DNS servers;
            * creating and deleting a port in a subnet;
            * enabling and disabling a port in a network;

          * managing public floating IP addresses in your project:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing direct public IP addresses in your project:
            * creating an IP address with an associated port (without adding to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * enabling and disabling a port with an IP address;

          * managing cloud routers in your project:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.viewer \{#vpc-viewer}

User with access to view everything that [`vpc.admin`](#vpc-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of all cloud platform network resources and information about them in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of all cloud platform network resources and information about them in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.private\_network.admin \{#vpc-private-network-admin}

User with access to managing private networks, subnets, and ports.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the [`member`](/access-control/role-reference.mdx#member) role.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of private networks, subnets, ports, and information about them in all projects;

          * managing private networks, subnets, and ports in all projects:
            * creating and deleting a network and subnet;
            * changing network and subnet names and tags;
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it (also requires the [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) role);
            * connecting a subnet to a global router and disconnecting it (also requires the [`global_router.admin`](/access-control/role-reference.mdx#global-router-admin) role);
            * creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server);
            * enabling and disabling a port in a network
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of private networks, subnets, ports, and information about them in your project;

          * managing private networks, subnets, and ports in your project:
            * creating and deleting a network and subnet;
            * changing network and subnet names and tags;
            * changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state);
            * connecting a subnet to a cloud router and disconnecting it (also requires the [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) role);
            * connecting a subnet to a global router and disconnecting it (also requires the [`global_router.admin`](/access-control/role-reference.mdx#global-router-admin) role);
            * creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server);
            * enabling and disabling a port in a network
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.private\_network.viewer \{#vpc-private-network-viewer}

User with access to view everything that [`vpc.private_network.admin`](#vpc-private-network-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of private networks, subnets, ports, and information about them in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of private networks, subnets, ports, and information about them in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.external\_access.admin \{#vpc-external-access-admin}

User with access to managing objects for internet access — public subnets, public floating IP addresses, cloud routers.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the [`compute.admin`](/cloud-servers/manage/manage-access.mdx#compute-admin) role.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects;

          * managing public subnets in all projects:
            * creating and deleting a subnet;
            * changing subnet name and tags;
            * changing DNS servers;
            * creating and deleting a port in a subnet;
            * enabling and disabling a port in a network

          * managing direct public IP addresses in all projects:
            * creating an IP address with an associated port (without adding to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * enabling and disabling a port with an IP address;

          * managing public floating IP addresses in all projects:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing cloud routers in all projects:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them (also requires the [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin))
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project;

          * managing public subnets in your project:
            * creating and deleting a subnet;
            * changing subnet name and tags;
            * changing DNS servers;
            * creating and deleting a port in a subnet;
            * enabling and disabling a port in a network

          * managing direct public IP addresses in your project:
            * creating an IP address with an associated port (without adding to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the [`compute.admin`](/access-control/role-reference.mdx#compute-admin) or [`compute.server.user`](/access-control/role-reference.mdx#compute-server-user) role);
            * enabling and disabling a port with an IP address;

          * managing public floating IP addresses in your project:
            * creating and deleting an IP address;
            * attaching an IP address to a port in a private network;
            * switching between ports;
            * detaching from a port;

          * managing cloud routers in your project:
            * creating and deleting a router;
            * changing a router name and tags;
            * enabling and disabling a router;
            * connecting the router to the internet and disconnecting it;
            * managing static routes on the router;
            * connecting private subnets to the router and disconnecting them (also requires the [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin))
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.external\_access.user \{#vpc-external-access-user}

User with access to view everything that [`vpc.external_access.admin`](#vpc-external-access-admin) manages in the same access scope, as well as access to managing public floating IP addresses.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the [`compute.admin`](/cloud-servers/manage/manage-access.mdx#compute-admin) role.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects;

          * managing public floating IP addresses in all projects:
            * attaching an IP address to a port in a private network, switching between ports, detaching from a port
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project;

          * managing public floating IP addresses in your project:
            * attaching an IP address to a port in a private network, switching between ports, detaching from a port
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.external\_access.viewer \{#vpc-external-access-viewer}

User with access to view everything that [`vpc.external_access.admin`](#vpc-external-access-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available cloud platform network operations</th>

        <td>
          In the Account access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />